ffirs.indd iii 27/02/04, 17:39:22 ffirs.indd iii 27/02/04, 17:39:22 ffirs.indd i 27/02/04, 17:39:19 ffirs.indd ii 27/02/04, 17:39:22 ffirs.indd iii 27/02/04, 17:39:22 Copyright © Andrew Holmes 2004 The right of Andrew Holmes to be identifi ed as the author of this book has been asserted in accordance with the Copyright, Designs and Patents Act 1988 First published 2004 by Capstone Publishing Limited (A Wiley Company) The Atrium Southern Gate Chichester West Sussex PO19 8SQ http://www.wileyeurope.com All Rights Reserved. Except for the quotation of small passages for the purposes of criticism and review, no part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechani- cal, photocopying, recording, scanning or otherwise, except under the terms of the Copyright, Designs and Patents Act 1988 or under the terms of a licence issued by the Copyright Licensing Agency Ltd, 90 Tottenham Court Road, London W1T 4LP, UK, without the permission in writing of the Publisher. Requests to the Publisher should be addressed to the Permissions Department, John Wiley & Sons Ltd, The Atrium, Southern Gate, Chichester, West Sussex PO19 8SQ, England, or emailed to [email protected], or faxed to (+44) 1243 770571. CIP catalogue records for this book are available from the British Library and the US Library of Congress ISBN 1-84112-507-5 Typeset in Meridien 10/14pt by Sparks Computer Solutions Ltd http://www.sparks.co.uk Printed and bound by TJ International Ltd, Padstow, Cornwall 10 9 8 7 6 5 4 3 2 1 Substantial discounts on bulk quantities of Capstone Books are available to corporations, professional associations and other organizations. For details telephone John Wiley & Sons on (+44-1243-770441), fax (+44- 1243-770571) or e-mail [email protected] ffirs.indd i 27/02/04, 17:39:23 Contents Introduction: You Can’t Escape Risk 1 1 The Foundations of Risk Management 13 2 Categories of Risk 45 3 Smart Thinking I: Know Your Risk Appetite 103 4 Smart Thinking II: Formalize the Process 123 5 Smart Thinking III: Develop a Risk Culture 149 6 Smart Thinking IV: Learn From Success and Failure 173 7 Risk Management and Decision Support 191 8 Risk Management and Innovation 217 9 Looking Forward to a Risk-free Future? 231 Glossary 243 Index 263 ftoc.indd i 23/02/04, 13:57:27 ftoc.indd ii 23/02/04, 13:57:28 Introduction: You Can’t Escape Risk Smart quotes Companies around the world have been taking a fresh, hard look at managing risk. In the process, they are redefi ning the role of risk man- agement in achieving objectives, and ultimately, increasing share- holder value. Their main goal is not to eliminate risk, but rather to be proactive in assessing and managing risk for their own advantage. PricewaterhouseCoopers None of us can escape risk. It is all around us. And over the last few years we have become more sensitive and perhaps a little more ac- customed to the types of risk that we face. For example, the Y2K bug highlighted the risks of an overdependence on computer-based technology; the terrorist attacks on the Twin Towers in New York reinforced the risks associated with a dissatisfaction with the grow- ing power and dominance of the US and Western capitalism; and the economic turbulence following the demise of the dotcom investment bubble brought into sharp relief the major risks we face when econo- mies struggle to grow. There is also a growing recognition that risk is more complex and systemic than it has ever been. Indeed, Tony Blair, the UK’s Prime Minister, has publicly stated that the complex nature of risk is making it much harder to identify, manage and control and his cintro.indd 1 23/02/04, 14:28:30 2 Smart Risk 2003 New Year message was particularly negative and focused on risk. Blair’s statement comes in the wake of the continued threats of terror- ist attacks, which themselves tend to heighten everyone’s awareness of the larger, but perhaps more remote, risks we have to deal with and often feel that we can’t. Smart quotes Risk management has become elevated because society is more wor- ried about the downside of risk, and managers are worried about appearing to be reckless and irresponsible in running an operation. Managers feel that, if a mistake were to happen, they would be unable to put their side of the story. Better to be safe than sorry. Senior man- agers therefore have new demands today – demands for information and assurances about risk. As a result, corporations have overseen an unprecedented number of initiatives under the risk management umbrella. Benjamin Hunt For example, in January 2003, police foiled a gang that was manufac- turing ricin for an attack in London. Although deadly when you come into contact with it, the likelihood of any one of us being killed in such an attack is very remote. But, once we are aware of the potential threat we all tend to believe that we are exposed to a much greater risk than we realize. In a similar vein, the risks of a warmer world, and of pollu- tion in general, are making individuals – and businesses in particular However well organised the – more concerned about pollution and the impacts of our carelessness foundations of when it comes to the environment. life might be, life must always be full of risks. Despite this increased sensitivity and awareness of risk, we tend to be poor at assessing and managing those risks that we have direct control Havelock Ellis over. In general we have a very poor understanding of the mathemati- cintro.indd 2 23/02/04, 14:28:31 Introduction 3 cal foundations that underlie effective risk management. And at the heart of this ignorance lies our inability to grasp the concept of prob- ability. So, although a terrorist attack on central London is probable, it is far more remote than being run over by a car. But we tend to believe the opposite. As a result we tend to pass through our daily lives managing the most common risks intuitively rather than explicitly. We all know that walking across the road has an inherent risk associated with it, as does driving a car, air travel and, increasingly in the UK, rail travel. As these and similar risks are still quite remote, we don’t tend to give them much thought until someone we know or love is involved in an inci- dent such as a car crash. Compare this to the much higher danger we associate with a terrorist attack, which is much less likely to happen. To a lesser or greater extent, we are taught from an early age to be careful and manage the low-level risks we face quite carefully (such as crossing the road) or dismissing them to fate (as in air travel). So un- less we are doing something that departs signifi cantly from our daily routine, such as jumping out of a plane or scuba diving, for example, we tend to take risk for granted and we often don’t give it a second’s thought. Also, at the individual level, if we take a risk and fail to man- age it properly, the damage is limited to us, and maybe our near rela- tives. In other words, few people are affected. However, when we el- evate risk to the corporate or national levels we can see more complex factors at work. For example, the BSE and foot-and-mouth crises in the UK resulted in many people’s livelihoods being virtually destroyed in the wake of a massive drop in livestock values in the former, and the near complete shutdown of the countryside during the latter. The foot-and-mouth crisis not only affected the farming communities, but also those involved with the tourist industry. The key thing to remem- ber about risk is that its effects are rarely isolated. Similarly, an entire country can be put at risk when its economy is managed badly. It is no surprise that there are numerous examples of countries having to be bailed out by the International Monetary Fund. cintro.indd 3 23/02/04, 14:28:31 4 Smart Risk Smart quotes The September 11th attacks underlined what a complex, risky world we live in; a world in which borders are open, communications are cheap, information plentiful, knowledge easy to acquire and as a re- sult risks and threats come from unusual sources. Charles Leadbeater The management of risk tends to be focused on the organization, as this is where the major complexities exist. This is because the implica- tions of poor risk management can have signifi cant impacts on a wider number of stakeholders including shareholders and employees, as well as the national and local economies. It is also because the nature of risk within organizations is far more complex than the simple risks we have to manage as individuals. Such risks cover the strategic and fi nancial aspects of the business, as well as those associated with maintaining effective operations and delivering change through projects and pro- grammes. Managing risk is therefore an essential skill of all modern corpora- Where there is risk, there is op- tions. And, for those who manage risk well, the rewards can be great. portunity. For example, Tesco, the giant UK food retailer, has consistently led the competition by being the fi rst to market with new innovations such as loyalty cards and Internet grocery shopping.